Class CpcRbacProvider

java.lang.Object

io.confluent.security.auth.provider.ConfluentProvider

io.confluent.security.auth.cpc.CpcRbacProvider

All Implemented Interfaces:

io.confluent.kafka.metadata.authorizer.AuthorizerExternalUpdater, io.confluent.security.authorizer.AclMigrationAware, io.confluent.security.authorizer.provider.AccessRuleProvider, io.confluent.security.authorizer.provider.Auditable, io.confluent.security.authorizer.provider.GroupProvider, io.confluent.security.authorizer.provider.MetadataProvider, io.confluent.security.authorizer.provider.Provider, io.confluent.security.authorizer.provider.SharedProvider, Closeable, AutoCloseable, org.apache.kafka.common.ClusterResourceListener, org.apache.kafka.common.Configurable, org.apache.kafka.server.authorizer.Authorizer

public class CpcRbacProvider
extends ConfluentProvider

RBAC provider for CPC (Confluent Private Cloud).

Strips tenant prefixes from resource names before RBAC rule lookup. ACLs use full prefixed names (e.g., lkc-123_topicA), but the RBAC store only has unprefixed names (e.g., topicA). This provider removes the prefix for MultiTenantPrincipal requests before delegating to the parent's findRule(). It also resolves the groups of a MultiTenantPrincipal from its plain User principal, since the RBAC store keys users as User:<name>, not TenantUser:<prefix><name>.

Only overrides providerName(), findRule(KafkaPrincipal, Set, String, Action), groups(KafkaPrincipal) and authStoreScope() — all other behavior is inherited from ConfluentProvider.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROVIDER_NAME

Constructor Summary

Constructors

Constructor	Description
CpcRbacProvider()

Method Summary

Modifier and Type	Method	Description
io.confluent.security.authorizer.Scope	authStoreScope()	Root the auth store / cache at Scope.ROOT_SCOPE for CPC.
io.confluent.security.authorizer.provider.AuthorizeRule	findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal, Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals, String host, io.confluent.security.authorizer.Action action)
Set<org.apache.kafka.common.security.auth.KafkaPrincipal>	groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)
String	providerName()

Methods inherited from class ConfluentProvider

acls, addMatchingRules, alternateScopeResolverHolder, asAuthorizer, auditLogProvider, authorize, authStore, close, completeInitialLoad, configure, createAcls, createAcls, createRbacAuthorizer, deleteAcls, deleteAcls, isSuperUser, mayDeny, migrationTask, onUpdate, providerConfigured, setKafkaMetrics, start, start, updateAuthCacheExternally, usesMetadataFromThisKafkaCluster

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.kafka.server.authorizer.Authorizer

aclCount, acls, authorizeByResourceType, config, registerAclUpdateListener

Field Details

PROVIDER_NAME

public static final String PROVIDER_NAME

See Also:

• Constant Field Values

Constructor Details

CpcRbacProvider

public CpcRbacProvider()

Method Details

providerName

public String providerName()

Specified by:

providerName in interface io.confluent.security.authorizer.provider.Provider

Overrides:

providerName in class ConfluentProvider

authStoreScope

public io.confluent.security.authorizer.Scope authStoreScope()

Root the auth store / cache at Scope.ROOT_SCOPE for CPC.

CPC role bindings live at per-tenant (lkc) kafka-cluster scopes, which are siblings of the physical cluster scope (neither contains the other). The cache's root scope gates both ingestion (updateRoleBinding) and lookup (findRule), so a cache rooted at the physical cluster scope would drop lkc-scoped bindings on load and throw InvalidScopeException on lkc-scoped checks. Rooting at ROOT_SCOPE lets the store hold and query bindings at any tenant scope. (MDS brokers already root at ROOT_SCOPE; this aligns non-MDS nodes such as the KRaft controller, which authorizes forwarded tenant requests like CreateTopics.) authScope is unchanged — still the physical cluster scope — so ACL operations remain scoped to this cluster.

Overrides:

authStoreScope in class ConfluentProvider

findRule

public io.confluent.security.authorizer.provider.AuthorizeRule findRule(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal,
 Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groupPrincipals,
 String host,
 io.confluent.security.authorizer.Action action)

Specified by:

findRule in interface io.confluent.security.authorizer.provider.AccessRuleProvider

Overrides:

findRule in class ConfluentProvider

groups

public Set<org.apache.kafka.common.security.auth.KafkaPrincipal> groups(org.apache.kafka.common.security.auth.KafkaPrincipal sessionPrincipal)

Specified by:

groups in interface io.confluent.security.authorizer.provider.GroupProvider

Overrides:

groups in class ConfluentProvider